CVE-2022-22793

Cybonet - PineApp Mail Relay Local File Inclusion

Cybonet - PineApp Mail Relay Local File Inclusion. Attacker can send a request to : /manage/mailpolicymtm/log/eml_viewer/email.content.body.php?filesystem_path=ENCDODED PATH and by doing that, the attacker can read Local Files inside the server.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Cybonet

Products

Pineapp Mail Secure

CVE-2022-22792

MobiSoft - MobiPlus User Take Over and Improper Handling of url Parameters

MobiSoft - MobiPlus User Take Over and Improper Handling of url Parameters Attacker can navigate to specific url which will expose all the users and password in clear text. http://IP/MobiPlusWeb/Handlers/MainHandler.ashx?MethodName=GridData&amp;GridName=Users

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Mobisoft - Mobiplus Project

Products

Mobisoft - Mobiplus

CVE-2022-22791

SYNEL - eharmony Authenticated Blind & Stored XSS

SYNEL - eharmony Authenticated Blind & Stored XSS. Inject JS code into the "comments" field could lead to potential stealing of cookies, loading of HTML tags and JS code onto the system.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Synel

Products

Eharmony

CVE-2022-22790

SYNEL - eharmony Directory Traversal

SYNEL - eharmony Directory Traversal. Directory Traversal - is an attack against a server or a Web application aimed at unauthorized access to the file system. on the "Name" parameter the attacker can return to the root directory and open the host file. The path exposes sensitive files that users upload

CVSS 3.1 · 5.6 Medium EPSS 1.0% KEV · Not listed

Vendors

Synel

Products

Eharmony

CVE-2022-22789

Charactell - FormStorm Enterprise Account Take Over

Charactell - FormStorm Enterprise Account takeover – An attacker can modify (add, remove and update) passwords file for all the users. The xx_users.ini file in the FormStorm folder contains usernames in cleartext and an obfuscated password. Malicious user can take over an account by replacing existing password in the file.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Charactell

Products

Formstorm

CVE-2022-22788

DLL injection in Zoom Opener installer for Zoom and Zoom Rooms clients

The Zoom Opener installer is downloaded by a user from the Launch meeting page, when attempting to join a meeting without having the Zoom Meeting Client installed. The Zoom Opener installer for Zoom Client for Meetings before version 5.10.3 and Zoom Rooms for Conference Room for Windows before version 5.10.3 are susceptible to a DLL injection attack. This vulnerability could be used to run arbitrary code on the victims host.

CVSS 3.1 · 7.1 High EPSS 1.5% KEV · Not listed

Vendors

Zoom

Products

Meetings Rooms

CVE-2022-22787

Insufficient hostname validation during Clusterswitch message in Zoom Client for Meetings

The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.10.0 fails to properly validate the hostname during a server switch request. This issue could be used in a more sophisticated attack to trick an unsuspecting users client to connect to a malicious server when attempting to use Zoom services.

CVSS 3.1 · 5.9 Medium EPSS 3.7% KEV · Not listed

Vendors

Zoom

Products

Meetings

CVE-2022-22785

Improperly constrained session cookies in Zoom Client for Meetings

The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly constrain client session cookies to Zoom domains. This issue could be used in a more sophisticated attack to send an unsuspecting users Zoom-scoped session cookies to a non-Zoom domain. This could potentially allow for spoofing of a Zoom user.

CVSS 3.1 · 5.9 Medium EPSS 3.5% KEV · Not listed

Vendors

Zoom

Products

Meetings

CVE-2022-22784

Improper XML Parsing in Zoom Client for Meetings

The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly parse XML stanzas in XMPP messages. This can allow a malicious user to break out of the current XMPP message context and create a new message context to have the receiving users client perform a variety of actions.This issue could be used in a more sophisticated attack to forge XMPP messages from the server.

CVSS 3.1 · 8.1 High EPSS 4.1% KEV · Not listed

Vendors

Zoom

Products

Meetings

CVE-2022-22783

Process memory exposure in Zoom on-premise Meeting services

A vulnerability in Zoom On-Premise Meeting Connector Controller version 4.8.102.20220310 and On-Premise Meeting Connector MMR version 4.8.102.20220310 exposes process memory fragments to connected clients, which could be observed by a passive attacker.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed

Vendors

Zoom

Products

Zoom On-premise Meeting Connector Controller Zoom On-premise Meeting Connector Mmr

CVE-2022-22782

Local privilege escalation in Windows Zoom Clients

The Zoom Client for Meetings for Windows prior to version 5.9.7, Zoom Rooms for Conference Room for Windows prior to version 5.10.0, Zoom Plugins for Microsoft Outlook for Windows prior to version 5.10.3, and Zoom VDI Windows Meeting Clients prior to version 5.9.6; was susceptible to a local privilege escalation issue during the installer repair operation. A malicious actor could utilize this to potentially delete system level files or folders, causing integrity or availability issues on the user’s host machine.

CVSS 3.1 · 7.9 High EPSS < 1% KEV · Not listed

Vendors

Zoom

Products

Meetings Rooms For Conference Rooms Vdi Windows Meeting Clients and 1 more

CVE-2022-22781

Update package downgrade in Zoom Client for Meetings for MacOS

The Zoom Client for Meetings for MacOS (Standard and for IT Admin) prior to version 5.9.6 failed to properly check the package version during the update process. This could lead to a malicious actor updating an unsuspecting user’s currently installed version to a less secure version.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Zoom

Products

Meetings

CVE-2022-22780

Zoom Chat Susceptible to Zip Bombing

The Zoom Client for Meetings chat functionality was susceptible to Zip bombing attacks in the following product versions: Android before version 5.8.6, iOS before version 5.9.0, Linux before version 5.8.6, macOS before version 5.7.3, and Windows before version 5.6.3. This could lead to availability issues on the client host by exhausting system resources.

CVSS 3.1 · 4.7 Medium EPSS 1.7% KEV · Not listed

Vendors

Zoom

Products

Meetings

CVE-2022-22779

Retained exploded messages in Keybase clients for macOS and Windows

The Keybase Clients for macOS and Windows before version 5.9.0 fails to properly remove exploded messages initiated by a user. This can occur if the receiving user switches to a non-chat feature and places the host in a sleep state before the sending user explodes the messages. This could lead to disclosure of sensitive information which was meant to be deleted from a user’s filesystem.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Apple Keybase Microsoft

Products

Macos Keybase Windows

CVE-2022-22778

TIBCO BusinessConnect Trading Community Management Cross-Site Request Forgery Vulnerability

The Web Server component of TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management contains an easily exploitable vulnerability that allows an unauthenticated attacker with network access to execute Cross-Site Request Forgery (CSRF) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management: versions 6.1.0 and below.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Tibco

Products

Businessconnect Trading Community Management

CVE-2022-22777

TIBCO BusinessConnect Trading Community Management Reflected Cross Site Scripting Vulnerability

The Web Server component of TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management contains easily exploitable Reflected Cross Site Scripting (XSS) vulnerabilities that allow an unauthenticated attacker with network access to execute scripts targeting the affected system or the victim's local system. Affected releases are TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management: versions 6.1.0 and below.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Tibco

Products

Businessconnect Trading Community Management

CVE-2022-22776

TIBCO BusinessConnect Trading Community Management Stored Cross Site Scripting Vulnerability

The Web Server component of TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management contains easily exploitable vulnerabilities that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack using these vulnerabilities requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management: versions 6.1.0 and below.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Tibco

Products

Businessconnect Trading Community Management

CVE-2022-22775

TIBCO ActiveMatrix BPM Reflected Cross Site Scripting (XSS) vulnerability

The Workspace client component of TIBCO Software Inc.'s TIBCO BPM Enterprise and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric contains difficult to exploit Reflected Cross Site Scripting (XSS) vulnerabilities that allow low privileged attackers with network access to execute scripts targeting the affected system or the victim's local system. Affected releases are TIBCO Software Inc.'s TIBCO BPM Enterprise: versions 4.3.1 and below and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric: versions 4.3.1 and below.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Tibco

Products

Bpm Enterprise Bpm Enterprise Distribution For Silver Fabric

CVE-2022-22774

TIBCO Managed File Transfer Command Center XXE Vulnerability

The DOM XML parser and SAX XML parser components of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center, TIBCO Managed File Transfer Command Center, TIBCO Managed File Transfer Internet Server, and TIBCO Managed File Transfer Internet Server contains an easily exploitable vulnerability that allows an unauthenticated attacker with network access to execute XML External Entity (XXE) attacks on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center: versions 8.3.1 and below, TIBCO Managed File Transfer Command Center: versions 8.4.0 and 8.4.1, TIBCO Managed File Transfer Internet Server: versions 8.3.1 and below, and TIBCO Managed File Transfer Internet Server: versions 8.4.0 and 8.4.1.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Tibco

Products

Managed File Transfer Command Center Managed File Transfer Internet Server

CVE-2022-22773

TIBCO JasperReports Server Reflected Cross Site Scripting (XSS) vulnerability

The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer Edition, TIBCO JasperReports Server for AWS Marketplace, TIBCO JasperReports Server for ActiveMatrix BPM, and TIBCO JasperReports Server for Microsoft Azure contains difficult to exploit Reflected Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker with network access to execute scripts targeting the affected system or the victim's local system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 8.0.1 and below, TIBCO JasperReports Server - Community Edition: versions 8.0.1 and below, TIBCO JasperReports Server - Developer Edition: versions 8.0.0 and below, TIBCO JasperReports Server for AWS Marketplace: versions 8.0.1 and below, TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.2 and below, and TIBCO JasperReports Server for Microsoft Azure: versions 8.0.1 and below.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Tibco

Products

Jasperreports Server